System and method for automated data breach compliance

ABSTRACT

Computer-implemented methods and systems for data breach compliance are disclosed. Organization related information may be received. Breach information relating to a data breach event of the organization may be received. The breach information may include, for example, breach event description information, compromised personally identifiable information, and remediation action information. A breach report may be generated based on the breach information, the organization related information, and one or more rules related to data breach. At least one reporting entity may be determined based on the organization related information, the breach information, and the one or more rules. The breach report may be output.

CROSS REFERENCE TO RELATED APPLICATION

This application is a continuation-in-part of U.S. Non-provisionalApplication No. 13/435,126 filed on Mar. 30, 2012, which is incorporatedby reference in its entirety herein.

BACKGROUND

Many organizations obtain, store, and/or safeguard private informationand/or data relating to individuals. Data breach events may occur inwhich private data becomes unprotected, is removed, is stolen, and/orotherwise transferred from the control of an organization. Breach eventsmay result from, for example, the actions of malicious outside parties,accidental disclosure, and/or other causes. Upon the occurrence of abreach event, one or more entities including, for example, federalgovernment, state government, foreign government, political union, lawenforcement, private entity, and other entities may each requirecompliance with complex specific rules, regulations, and laws related todata breach reporting. Complying with all of the applicable laws, rules,and regulations upon the occurrence of a data breach event may thereforebe cumbersome.

SUMMARY

Briefly, aspects of the present disclosure are directed to methods andsystems for data breach compliance. Organization related information maybe received. Breach information relating to a data breach event of theorganization may be received. The breach information may include, forexample, breach event description information, compromised personallyidentifiable information, and remediation action information. A breachreport may be generated based on the breach information, theorganization related information, and one or more rules related to databreach. At least one reporting entity may be determined based on theorganization related information, the breach information, and the one ormore rules. The breach report may be output.

This SUMMARY is provided to briefly identify some aspects of the presentdisclosure that are further described below in the DESCRIPTION. ThisSUMMARY is not intended to identify key or essential features of thepresent disclosure nor is it intended to limit the scope of any claims.

The term “aspects” is to be read as “at least one aspect.” The aspectsdescribed above and other aspects of the present disclosure describedherein are illustrated by way of example(s) and not limited in theaccompanying figures.

BRIEF DESCRIPTION OF THE DRAWINGS

A more complete understanding of the present disclosure may be realizedby reference to the accompanying figures in which:

FIG. 1 is a flowchart of a method according to aspects of the presentdisclosure;

FIG. 2 is a flow diagram depicting operations of a method according toaspects of the present disclosure;

FIG. 3 is a flow diagram depicting operations of a method according toaspects of the present disclosure;

FIG. 4 is a flow diagram depicting operations of a method according toaspects of the present disclosure;

FIG. 5 depicts an aspect of the present disclosure in which breachinformation is received; and

FIG. 6 is a schematic diagram depicting a representative computer systemfor implementing and exemplary methods and systems for performingautomated data breach compliance according to aspects of the presentdisclosure.

The illustrative aspects are described more fully by the Figures anddetailed description. The present disclosure may, however, be embodiedin various forms and is not limited to specific aspects described in theFigures and detailed description.

DESCRIPTION

The following merely illustrates the principles of the disclosure. Itwill thus be appreciated that those skilled in the art will be able todevise various arrangements which, although not explicitly described orshown herein, embody the principles of the disclosure and are includedwithin its spirit and scope.

Furthermore, all examples and conditional language recited herein areprincipally intended expressly to be only for pedagogical purposes toaid the reader in understanding the principles of the disclosure and theconcepts contributed by the inventor(s) to furthering the art, and areto be construed as being without limitation to such specifically recitedexamples and conditions.

Moreover, all statements herein reciting principles and aspects of thedisclosure, as well as specific examples thereof, are intended toencompass both structural and functional equivalents thereof.Additionally, it is intended that such equivalents include bothcurrently known equivalents as well as equivalents developed in thefuture, for example, any elements developed that perform the samefunction, regardless of structure.

Thus, for example, it will be appreciated by those skilled in the artthat any block diagrams herein represent conceptual views ofillustrative circuitry embodying the principles of the disclosure.Similarly, it will be appreciated, that any flow charts, flow diagrams,state transition diagrams, pseudocode, and the like represent variousprocesses which may be substantially represented in computer readablemedium and so executed by a computer or processor, whether or not suchcomputer or processor is explicitly shown.

The functions of the various elements shown in the Figures, includingany functional blocks labeled as “processors,” may be provided throughthe use of dedicated hardware as well as hardware capable of executingsoftware in association with appropriate software. When provided by aprocessor, the functions may be provided by a single dedicatedprocessor, by a single shared processor, or by a plurality of individualprocessors, sonic of which may be shared. Moreover, explicit use of theterm “processor” or “controller” should not be construed to referexclusively to hardware capable of executing software, and mayimplicitly include, without limitation, digital signal poor (DSP)hardware, network processor, application specific integrated circuit(ASIC), field programmable gate array (FPGA), read-only memory (ROM) forstoring software, random access memory (RAM), and non-volatile storage.Other hardware, conventional and/or custom, may also be included.

Software modules, or simply modules which are implied to be software,may be represented herein as any combination of flowchart elements orother elements indicating performance of process steps and/or textualdescription. Such modules may be executed by hardware that is expresslyor implicitly shown.

Unless otherwise explicitly specified herein, the drawings are not drawnto scale.

Methods and systems of the present disclosure may aid an organization(e.g., a business entity, government entity, non-profit organization,and/or other type of organization) in complying with state, federal,international, private sector, industry, and other entity roles, laws,and regulations in the event of a data breach. A breach event asdiscussed herein may refer to a data breach event, a suspected databreach event, or any other similar occurrence.

In FIG. 1, there is shown a flowchart 100, which defines steps of amethod according to aspects of the present disclosure. Methods andsystems of the present disclosure may be implemented using, for example,a computer system 400 as depicted in FIG. 6 or any other system and/ordevice.

In operation 110, organization related information may be received. Anorganization may be, for example, a business, a group, a not-for-profitorganization, a governmental entity, education based organization, afinancial services organization, health care related organization,and/or any other type of organization. The organization relatedinformation may include information describing, representative of,and/or relating to an organization. Organization related information mayinclude, for example, organization name(s), address(es), telephonenumber(s), web address(es), Email address(es), date of founding,representative name(s), and other information related to theorganization. Organization related information may include, for example,geographic locations (e.g., cities, states, regions, countries, or anyother type of location) in which an organization engages in business.Organization related information may include description of activitiesof the organization, types of business the organization engages in,whether the organization is active or inactive, whether the organizationis engaged in E-commerce, whether the organization participates in oneor more states' Electronic Benefits Program (EBT), and/or any otherinformation relating to the organization.

In some aspects, an organization may, for example, store informationrelated to one or more individuals. An organization may, for example,store information in an electronic storage location, physical storagelocation, and/or any other type of storage. The stored information mayinclude, for example, personally identifiable information (PII) relatedto one or more individuals.

In some aspects, organization related information may be received from auser via an input/output device (e.g., input/output structure 440 ofFIG. 6). A user may, for example, enter information into system using akeyboard, pointer device, mouse, microphone, camera, and/or any othertype of input device. In some aspects, organization related informationmay be received from a system, device, and/or apparatus separate fromsystem 400. Organization related information may, for example, betransferred to system 400 over any suitable communication medium (e.g.,the internet) in for example, a data file. In some aspects, informationregarding a breach event may be communicated over the phone, and arepresentation of the telephone communication (e.g., a phoneconversation) may be received as breach information.

In operation 120, breach information related to a data breach event ofthe organization may be received. The breach information may include,for example, breach event description information, compromised PII, andremediation action information. A breach event may occur in manydifferent circumstances in which information is transferred to, movedto, altered by, disclosed to, and/or otherwise accessed by a thirdparty. A breach event may be the result of, for example, theft,trespass, loss, and/or other type of wrongdoing. A breach event may alsooccur inadvertently.

Breach event description information (e.g., a description of the breachevent) may include, for example, a description of a breach event orsuspected breach event. Breach event information may include, forexample, names of persons associated with review of the breach event.Breach event information may, for example, include date(s) on which thebreach occurred, estimated or actual time(s) at which the breachoccurred, estimated or actual time(s) at which the breach is suspectedto have occurred, date and/or time(s) at which the breach wasdiscovered, location(s) of breach event, a description of the breachevent, and/or any other information related to the breach event. Breachevent information may include equipment related to the breach event.Equipment related to the breach event may include, for example,electronic data storage equipment (e.g., on computer(s), laptop(s),mobile device(s), server(s), hard-drive(s), portable storage device(s),thumb drive(s), USB device(s), CD(s), DVD(s), tape(s), and/or or anyother electronic storage location and/or media), physical storageequipment (e.g., a vault, locked room, protected room, safe, and/orother physical storage equipment). Breach event information may includeinformation representing impact on parties and/or entities associatedwith and/or related to the organization (e.g., data hosting companies,middleware software applications; business associates, banks, financialinstitutions, merchant service providers, or other parties). Breachevent information may include, for example, a description of the factsassociated with the event including whether the breach event was a lossor theft of a device and/or media, an internal system breach, a resultof insider wrongdoing, an external system breach (e.g., hacking,cracking, and/or theft), an inadvertent disclosure, and/or any othertype of event.

Compromised PII may include, for example, information disclosed, stolen,removed, compromised, acquired, and/or otherwise interfered with as aresult of the breach event. PII may include, for example, informationthat may be used to uniquely identify, contact, and/or locate a singleindividual. PII may include, for example, name, date of birth, socialsecurity number, driver's license number, credit card number, debit cardnumber, check routing number, check transit number, bank accountnumbers, tax identification numbers, personal identification number(s)(PIN), security code(s), access code(s), medical information, and/or anyother type of information that may be used to uniquely identify anindividual. Compromised PII may include a list of individuals, number ofindividuals, or other data representing the individuals affected by abreach event. By way of example, compromised PII may include names,residence information (e.g., address, city, state, and/or country ofresidence), type(s) of PII disclosed (e.g., a name or other personalidentifier and social security number, driver's license number,financial account number, credit card number, etc.), and possibly otherinformation representative of individuals affected by the data breach.

Remediation action information may include, for example, informationrelating to actions taken and/or performed by an organization inresponse to a breach event. In response to a breach, an organizationmay, for example, perform actions including notifying entities (e.g.,law enforcement authorities, credit card companies, parent company,affiliates, customer(s), bank(s), ISO/Merchant service provider(s),government entities, and/or other entities as discussed below),performing internal investigation(s), conducting internal audit(s),and/or any other action(s) taken by an organization in response to abreach event. An organization may, for example, confiscate equipmentrelated to the breach event. An organization may for example, respond toa breach event by changing data storage policies, increasing securitymeasures, altering data storage locations, increasing protection ofstored information, and performing other actions. Remediation actioninformation may include, for example, a description of actionsperformed, date and time of actions performed, and possibly otherinformation.

In some aspects, breach information may be received in an input field(e.g., in a web browser, word processing application, or other type ofapplication) from a user. Breach information may alternatively bereceived at, for example, system 400 as a text file (e.g., commaseparated values file), spreadsheet, or other type of data file. Textreceived at system 400 may be organized and/or separated into breachevent description information, compromised PII, and remediation actioninformation using text recognition, data mining, or other techniques.

In some aspects, information regarding a breach event may be receivedthrough an application programming interface (API), for example,associated with the system 400. For example, an API may be provided toan organization (e.g., a financial institution). The API may be includedin (e.g., embedded in) a secure web-page, for example, accessible onlyby representatives of the organization. Upon detection of a breachevent, breach information may be entered by the organization (e.g., thefinancial institution) into data entry fields within the API.

In some aspects, audio representative of breach information may bereceived and the audio may be converted to text using a speech-to-textconversion operation or any other suitable audio conversion operation.By way of example, a user may provide audio (e.g., a voice recording, avoicemail message, a recorded phone call) including information relatedto a data breach. The audio may be received by, for example, system 400and may be converted to text using any suitable speech-to-textoperation. The text may be organized and/or separated by system 400 intobreach event description information, compromised PII, and remediationaction information. The text may be organized and/or separated usingtext recognition, data mining, or other techniques. For example, audiomay be converted to text, and the text may be searched for one or morekeywords, phrases, or terms. The keywords, phrases, or terms may, forexample, relate to the breach event description, PII, remediation actioninformation, or other information associated with data breach. The textmay be categorized into breach event description information,compromised PII, and remediation action information based on the resultsof the search.

In operation 130, a breach report may be generated based on the breachinformation, the organization related information, and rules related todata breach (e.g., data breach reporting rules). For example, a breachreport may be or may include a document, populated form, table, audiorecording, video, and/or any other medium for presenting information. Abreach report may, for example, include organization relatedinformation, breach event description information, compromised PII,remediation action information, and other information organized in apredetermined format. The predetermined format may, for example, bedictated by applicable data breach reporting rules (e.g., state laws,federal laws, private entity rules), clarity consideration, and/or otherfactors. In some aspects, the predetermined format may be determinedbased on applicable international (e.g., European Union (EU) and/orforeign country) data breach reporting rules and for regulations.

Rules related to data breach may be, for example, federal laws (e.g.,federal privacy laws); federal regulations (e.g., federal privacyregulations); federal court opinions; federal trade commission (FTC)administrative decisions and consent decrees; state laws; stateregulations; state attorney general consent decrees; company privacypolices; industry policies; international privacy laws (e.g., EU privacylaws or any country's privacy laws); international regulations (e.g., EUprivacy regulations or any country's privacy regulations); internationalcourt decisions and/or opinions; and/or any other rules, regulations,statutes, laws and/or guidelines.

In some aspects, a breach report may be generated based on theorganization related information, breach information, and rules relatedto data breach. The organization related information, breachinformation, and rules related to data breach may be used to, forexample, determine the rules applicable to a specific data breach eventof an organization. The one or more data breach reporting rules,organization related information, breach information, and possibly otherinformation may, for example, be stored in a database and organized intomatrices or any other suitable data structure. In order to determine therules related to data breach applicable to a specific data breach event,organization related information, breach information, and potentiallyother information may be compared to rules related to data breach (e.g.,stored in a database). Text searching, data comparison, and otheroperations may be used to determine rules applicable to the data breach.Conditional logic may, for example, be used to determine which of one ormore data breach reporting rules may be applicable based on theorganization related information, the breach information, and possiblyother information. In some aspects, a decision tree, graphical model, orother suitable approaches may be used to determine applicable databreach reporting rules.

In operation 140, at least one reporting entity may be determined and/orselected based on the organization related information, breachinformation, one or more rules, and possibly other information. Areporting entity may be, for example, a federal government agency (e.g.,Office for Civil Rights, Office of Health and Human Services, SecretService, and/or any other government agency), a state government agency(e.g., Office of the Attorney General for a state, Office of CyberSecurity, Department of State Division of Consumer Protection, StateDepartment of Health, or any other state government agency),international government agency (e.g., an EU and/or foreign governmentagency) private entity (e.g., a credit card company, a business, anorganization, and/or any other private entity), an individual (e.g., anindividual affected by the data breach event), and/or any other entity.

At least one reporting entity may be determined and/or selected based onthe organization related information, breach information, and one ormore rules applicable to data breach. There may be for example, nosingle law (e.g., state law, federal law, international law, law of aforeign country, etc.), statute and/or regulation that governs anorganization's obligations in the event of a data breach. Instead, theremay be an evolving patchwork of international, federal, and states lawsand regulations; E-transaction laws; evidentiary rules; industrystandards; and other rules governing the use of personal information.Text searching, data comparison, and other operations may be used todetermine rules applicable to the data breach. Conditional logic may,for example, be used to determine which of one or more data breachreporting rules may be applicable based on the organization relatedinformation, the breach information, and possibly other information, insome aspects, a decision tree, graphical model, or other suitableapproaches may be used to determine applicable data breach reportingrules. Based on the applicable rules, at least one reporting entity maybe determined and/or selected.

In some aspects, rules (e.g., federal laws, state laws, private entityrules, and/or any other rules) related to and/or applicable to databreach may be updated, modified, and/or altered. Updates to rulesapplicable to data breach may be received from, for example,subscription services, organizational memberships, news data feeds,and/or any other source of information. The information used to updateapplicable rules may, for example, be reviewed, monitored, curated,and/or supervised by a user (e.g., a subject matter expert in, forexample, data breach compliance). Similarly, outdated information may beremoved from a database of rules by, for example, system 400 and/or auser. A process of determining a reporting entity may be updated and/orrefined based on additions, changes, and/or modifications to rulesrelated to and/or applicable to data breach.

In some aspects, the reporting entities associated with a breach reportmay be determined based on remediation action information. For example,if the remediation action information indicates that an entity has beennotified, that entity will not be selected or determined to be areporting entity.

According to some aspects, reporting entities may be determined based onat least one geographic location associated with the data breach event.The at least one geographic location may be based, for example, onorganization related information, breach information, and one or morerules related to data breach. By way of example, if the organization isa business incorporated in and/or having a presence in a specific state,that state's laws may be applicable to a data breach event of thatorganization. Similarly, if PII related to individuals who reside in acertain state is breached and that states laws include long reach and/orlong arm provisions extending its jurisdiction to other states, thatstate's laws may be applicable to the data breach event. If, forexample, compromised PII includes information related to residents ofmultiple countries and/or countries other than the United States,international laws (e.g., EU or foreign country rules and regulations)may be applicable to a data breach event of that organization.

According to some aspects, reporting entities may be determined and/orselected based on one or more types of breached data. One or more typesof breached data may be determined based on, for example, compromisedPII. For example, compromised PII may include health care relatedinformation (e.g., medical records) associated with one or moreindividuals. State laws, federal laws (e.g., Health InsurancePortability and Accountability Act of 1996 (HIPAA), Health InformationTechnology for Economic and Clinical Health (HITECH)), federal agencyregulations, and other rules applicable to health care privacy and/orsecurity may be deemed applicable. A reporting entity may, for example,be determined based on applicable rules and the type of data breached.For example, federal, state, international, foreign country, andpossibly other health care related agencies may be deemed reportingentities.

In operation 150, a breach report may be output. A breach report may,for example, be output to a user of system 400. A breach report may, forexample, be output to a reporting entity (e.g., crime enforcementagency, federal government agency, state agency, foreign governmentagency, private entity, credit card company, and/or other type ofentity).

In some aspects, a list or other data structure including one or morereporting entities and addresses associated with the reporting entitiesmay be generated based on the organization related information, thebreach information, and the rules related to the data breach event. Abreach report may be output to the reporting entities at the addresses.An address associated with an reporting entity may be, for example, amailing address, an email address, a website address, an file transferprotocol (FTP) site, or any other type of address. The breach report maybe output to the reporting entity a the address by, for example,transmitting the report to the address via email, electronic filetransfer (e.g., FTP file transfer), or using other approaches. Thebreach report may be output as one or more physical documents, a digitalfile, or any other format.

In some aspects, a database may be updated to include receivedorganization related information, breach information, and a generatedbreach report. The database may include information relating to multipleorganizations, multiple data breach events, and other relatedinformation. The database may be used to analyze information related tobreach events. In some aspects, a request for one or more breach reportsrelated to a selected organization may be received. In response to therequest, a list of breath reports related to a selected organization maybe generated based on the organization related information, the breachinformation, and one or more breach reports in the database.

In FIG. 2, there is shown a flow diagram 200, which defines steps of amethod according to aspects of the present disclosure. Organizationrelated information may be received and, in some aspects, stored duringan account or profile creation operation. An account or profileassociated with an organization may be generated to include organizationrelated information (e.g., name of organization, contact information,and other information as discussed previously in connection with FIG.1).

In response to a data breach event or suspicion of a data breach event,breach information may be received 205 by, for example, system 400. Asdescribed above, a breach report may be generated 210 based on thestored organization related information, breach information, and rulesrelated to data breach. Based on a comparison of the organizationrelated information, the breach information, and rules related to databreach, it may be determined 215 whether the breach report is in aproper format. In some aspects, whether a breach report is in a properformat may be determined based on, for example, state rules, federalrules, international rules (e.g., EU regulations), industry standards,or other rules applicable to the breach event. For example, rulesrelated to data breach reporting in New York, North Carolina, somefederal agencies, and possibly other entities may require breach reportsbe generated in an entity specific format. All entity specific formatmay be, for example, a form including predetermined data entry fields orany other type of format. A breach report may be generated and/ormodified 220 to conform to an entity specific format.

In some aspects, a breach report may be reviewed 225 to ensure that thebreach report includes correct information, complete information,correctly formatted information, and otherwise conforms to a predefinedset of standards. In a review operation 225, a breach report may beoutput to, for example, a user, to a system external to system 400,and/or any other system or device for review. Modified and/or updatedorganization related information and breach information may be received230 by, for example, system 400. Modified organization relatedinformation and modified breach information may be generated by, forexample, system 400 in an error detection and/or correction operationperformed on the breach report. Modified organization relatedinformation and modified breach information may be generated by a user(e.g., a breach report review specialist) based on, for example, areview of the breach report. The breach report may be updated based onthe modified organization related information and modified breachinformation. A breach report may be updated by, for example, generatinga breach report 210 based on modified organization related information,modified breach information, and data breach reporting rules.

In some aspects, at least one reporting entity may be determined orselected 235 based on the organization related information, the breachinformation, and one or more rules. If, for example, the data breachoccurred in the United States and/or affected United States citizens,residents, and/or people located in the United States, at least onereporting entity may be determined or selected 240 based on rulesrelated to the U.S. federal government, state government(s), and/orother entities. If, for example, the data breach occurred in a countryother than the U.S. and/or affected non-U.S. citizens, residents, and/orpeople located outside the United States, at least one reporting entitymay be determined 270 based on rules related to the one or morepolitical unions (e.g., the European Union), foreign government(s),state government(s), and/or other entities.

In FIG. 3, there is shown a flow diagram 200, which defines steps of amethod according to aspects of the present disclosure. The flow diagramshown in FIG. 3 may, in some aspects, be associated with the flowdiagram(s) shown in FIG. 2 and/or FIG. 4 below. The flow diagrams shownin FIG. 2, FIG. 3, and/or FIG. 4 may, for example, constitute one flowdiagram depicting the steps of a method according to aspects of thepresent disclosure.

According to some aspects, when a data breach occurs in the UnitedStates and/or affects United States citizens, residents, and/or peoplelocated in the United States, at least one reporting entity may bedetermined or selected 240 based on rules related to the U.S. federalgovernment, U.S. state government(s), and/or other entities. In someaspects, if the data breach occurred in the United States and/oraffected United States citizens, residents, and/or people located in theUnited States, the federal government (e.g., Federal Bureau ofInvestigation and/or other agencies within or associated with thefederal government) may require notification, reporting, and/orconsultation 242 regarding the breach within a predetermined period oftime. A breach report may be output 242 to an entity associated with theU.S. federal government.

According to some aspects, a reporting entity may be determined orselected 250 based on a geographical location associated with thebreach. A geographical location associated with the breach event may be,for example, a state in which an organization is located, where abusiness is incorporated and/or registered, a state in which facilitiesand/or equipment owned by the organization are located (e.g., offices,retail locations, manufacturing facilities, server location(s)), and/ora state which is otherwise related to the organization and/or to thebreach event. A geographical location associated with the breach eventmay be, for example, a state, county, or other location where anindividual affected by the breach resides, is domiciled, or is otherwiselocated. It may, for example, be determined whether the geographiclocation associated with the breach event is in the United States, oneor more states, or any other geographic region.

In some aspects, reporting entities may be determined or selected 252based or attorney general reporting rules (e.g., included in rulesrelated to a data breach event) for a state (e.g., a geographicallocation). Whether any attorney general reporting rules are applicablemay be determined based on the attorney general rules related to a databreach event. Some states may, for example, require consultation,reporting, and/or notification of the attorney general of that state.And, some states may require reporting to the attorney general's officeof that state, for example, within a set period of time (e.g., withinfive days of discovery of the breach or an other period of time), if thebreach occurred in that state (e.g., the organization is located in thatstate, equipment associated with the breach is located within thatstate, etc.). The breach report may be output 253 to at least onereporting entity determined or selected based on attorney general reportrules.

In some aspects, reporting entities may be determined or selected 254based on long reach and/or long arm attorney general reporting rules(e.g., included in rules related to a data breach event) for a state(e.g., a geographical location). Rules related to a data breach event(e.g., long reach rules) for some states may require consultation,reporting, and/or notification of the attorney general of that state ifa resident of that state or predetermined number of residents of thatstate are affected by a data breach. The breach report may be output 255to at least one reporting entity determined or selected based on longreach and/or long arm attorney general reporting rules for a state.

According to some aspects, one or more reporting entities may bedetermined or selected 260 based on one or more types of breached data.One or more types of breached data may be determined based on, forexample, compromised PII, breach event description information,organization related information, or any other information related tothe breach event.

In some aspects, one or more reporting entities may be determined orselected 262 based on whether the breached data includes health carerelated information. Health care related information (e.g., medicalrecords, patient records, prescription records, and/or other health carerelated information or data) and health care related laws, regulations,and rules (e.g., HIPAA, HITECH, or other health care related laws) maybe applicable to the data breach event. Based on the applicable healthcare related rules, at least one reporting entity associated with healthcare (e.g., Office of Civil Rights, Office of Health and Human Services,Secret Service regional office, and/or other entities) may be determinedand/or selected. And a breach report may be output 263 to a reportingentity associated with health care.

According to some aspects, one or more reporting entities may bedetermined or selected 264 based on whether the breached data includescredit card related information. Credit card related information mayinclude, for example, credit card number(s), credit card personalidentification number(s), or other information. The credit card relatedinformation may be associated with one or more credit card companies(e.g., American Express, Visa, MasterCard, Discover, or any other creditcard company), and credit card company rules may be applicable to thedata breach event. Based on the credit card company rules, at least onecredit card company may be deemed and/or selected as a reporting entity.And a breach report may be output 265 to the credit card company (e.g.,a reporting entity).

According to some aspects, one or more reporting entities may bedetermined or selected 266 based on whether the breached data includesPII. When breached data includes, for example PII, certain federal,state, international, private entity, and/or other types of rules,regulations, and laws may be applicable. Based on the applicable rules,regulations, and laws, at least one reporting entity (e.g., the SecretService and/or any other entity) may be determined 266, and the breachreport may be output 267 to the at least or PII related reportingentity.

In FIG. 4, there is shown a to diagram 200, which defines steps of amethod according to aspects of the present disclosure. The flow diagramshown in FIG. 4 may, in some aspects, be associated with the flowdiagrams(s) shown in FIG. 2 and/or FIG. 3. The flow diagrams shown inFIG. 2, FIG. 3, and/or FIG. 4 may, for example, constitute one flowdiagram depicting the steps of a method according to aspects of thepresent disclosure.

According to some aspects, when a data breach occurs in a country otherthan the U.S. and/or affects non-U.S. citizens, residents, and/or peoplelocated outside the United States, at least one reporting entity may bedetermined or selected 270 based on rules related to the one or morepolitical unions (e.g., the European Union), foreign government(s),state government(s), and/or other entities.

In some aspects, if the data breach occurred outside of the UnitedStates and/or affected non-U.S. citizens, residents, and/or peoplelocated outside the United States, an entity associated with a foreigngovernment (e.g., the EU) may require notification, reporting, and/orconsultation regarding the breach within a predetermined period of time.

According to some aspects, a reporting entity may be determined and/orselected 280 based on an international jurisdiction associated with thebreach. An international jurisdiction associated with the breach eventmay be, for example, a political union (e.g., the EU), foreign country,and/or state in a foreign country in which an organization is located,where a business is incorporated and/or registered, in which facilitiesand/or equipment owned by the organization are located (e.g., offices,retail locations, manufacturing facilities, server location(s)), and/orwhich is otherwise related to the organization, and/or to the breachevent. An international jurisdiction associated with the breach eventmay be, for example, a political union (e.g., EU), country, state, orother location where an individual affected by the breach resides, isdomiciled, or is otherwise located. It may, for example, be determinedwhether the geographic location associated with the breath event is inCanada, the EU, or any other geographic region.

In some aspects, a breach report may be output 282 to one or morereporting entities (e.g., jurisdiction related reporting entities) thatare determined or selected based on rules associated with theinternational jurisdiction. For example, a breach report may be outputto one or more reporting entities determined and/or selected based ondata breach reporting rules associated with the EU (e.g., EU data breachreporting rules). The one or more reporting entities may be, forexample, associated with one or more countries in the EU.

According to some aspects, a reporting entity determined or selected 290based on or more types of breached data. One or more types of breacheddata (e.g., health care related information, credit card relatedinformation, PII) may be determined based on, for example, compromisedPII, breach event description information, organization relatedinformation, or any other information related to the breach event. Oneor more reporting entities may be determined 290 based on the one ormore types of breached data and rules associated with the one or moretypes of breached data in the international jurisdiction, country,state, or other entity. A breach report may be output 292 to the entityassociated with the type of breached data.

According to some aspects, one or more types of breached data mayinclude PII, and certain international jurisdiction rules (e.g., EUrules) other types of rules, regulations, and laws related to PII may beapplicable. Based on the applicable rules, regulations, and laws relatedto PII, at least one reporting entity (e.g., an EU related entity) maybe determined 290, and the breach report may be output 292 to the atleast one reporting entity.

FIG. 5 depicts an aspect of the present disclosure in which breachinformation is received. Breach information may be received from a userin a data entry interface 300 (e.g., one or more data entry fields in awebpage, online form, etc.). The breach information may include breachevent description information 310, compromised PII 320, remediationaction information 330, and possibly any other information 340 relatedto the breach event. Breach event description information 310 mayinclude, for example, a date of the breach event 312, a date ofdiscovery of the breach event or suspected breach event 314. Breachevent information may, for example, be received in one or more dataentry fields including a breach event description field 310, acompromised PII entry field 320, a remediation action entry field 330,an other information entry field 340, and possibly other data entryfields.

According to some aspects, the data entry interface 300 may be generatedbased on previously received organization related information, breachevent description information, compromised PII, remediation actioninformation, or other information. The data entry fields in the dataentry interface 300 may be generated based on the previously receivedinformation from an organization. For example, if an organization haspreviously provided information relating to, for example, a previousdata breach, the one or more data entry fields may be generated toinclude greater or fewer data entry fields based on the previouslyprovided information. The one or more data entry fields may, forexample, be customized based on the previously provided information. Oneor more custom data entry fields may, for example, prompt a user toinput specific information relating to or derived from the previouslyprovided information. Modifying the one or more data entry fields basedon previous breach events related to an organization may ensure that thedata fields are specifically tailored to the organization.

In some aspects, one or more data entry fields (e.g., data entry fields310, 312, 314, 320, 330, 340) in the data entry interface 300 may bepre-populated based on previously received breach event descriptioninformation, compromised PII, remediation action information, andpossibly any other information related to a previous breach eventassociated with the organization. A user may, for example, be promptedto check the accuracy of and edit one or more of the pre-populated dataentry fields.

In some aspects, the data entry interface 300 including one or more dataentry fields may be generated based on breach information associatedwith one or more additional organizations. For example, if breachinformation is received from multiple related organizations (e.g.,businesses, organizations, or entities in the same industry), datafields for one organization may be generated based on the breachinformation previously received from other related organizations.

FIG. 6 shows an illustrative computer system 400 suitable forimplementing methods and systems according to an aspect of the presentdisclosure. The computer system may comprise, for example, a computerrunning any of a number of operating systems. The above-describedmethods of the present disclosure may be implemented on the computersystem 400 as stored program control instructions.

Computer system 400 includes processor 410, memory 420, storage device430, and input/output structure 440. One or more input/output devicesmay include a display 445. One or more busses 450 typically interconnectthe components, 410, 420, 430, and 440. Processor 410 may be a single ormulti core.

Processor 410 executes instructions in which aspects of the presentdisclosure may comprise steps described in one or more of the Figures.Such instructions may be stored in memory 420 or storage device 430.Data and/or information may be received and output using one or moreinput/output devices.

Memory 420 may store data and may be a computer-readable medium, such asvolatile or non-volatile memory, or any non-transitory storage medium.Storage device 430 may provide storage for system 400 including forexample, the previously described methods. In various aspects, storagedevice 430 may be a flash memory device, a disk drive, an optical diskdevice, or a tape device employing magnetic, optical, or other recordingtechnologies.

Input/output structures 440 may provide input/output operations forsystem 400. Input/output devices utilizing these structures may include,for example, keyboards, displays 445, pointing devices, andmicrophones—among others. As shown and may be readily appreciated bythose skilled in the art, computer system 400 for use with the presentdisclosure may be implemented in a desktop computer package 460, alaptop computer 470, a hand-held computer, for example a tabletcomputer, personal digital assistant, mobile device, or smartphone 480,or one or more server computers that may advantageously comprise a“cloud” computer 490.

At this point, while we have discussed and described the disclosureusing some specific examples, those skilled in the art will recognizethat our teachings are not so limited. Accordingly, the disclosureshould be only limited by the scope of the claims attached thereto.

What is claimed is: 1-19. (canceled)
 20. A computer-implemented systemfor data breach compliance comprising: a processor; and a memory incommunication with the processor; said system configured to: receiveinformation related to an organization; receive breach informationrelating to a data breach event of the organization, the breachinformation including breach event description information, compromisedpersonally identifiable information (PII), and remediation actioninformation; generate a breach report based on the breach information,the organization related information, and one or more rules related todata breach; select one or more reporting entities based on one or moretypes of breached data, where the one or more types of breached data aredetermined based on the compromised PII, wherein the system isconfigured to: select, if the breached data includes health care relatedinformation, at least one reporting entity associated with health care,select, if the breached data includes credit card related information,at least one credit card related entity, and select a reporting entitybased on one or more of rules, regulations, and laws associated with thecompromised PII; and output the breach report to the one or morereporting entities.
 21. The computer implemented system of claim 20,wherein the system is further configured to output, if the breachinformation indicates the breach is related to the United States, thebreach report to a United States agency.
 22. The computer implementedsystem of claim 20, wherein the system is further configured to outputthe breach report to a reviewing entity.